2

I'm taking steps to secure my laptop - from both a data security and physical security point of view.

I currently have full disk encryption with LUKS set up through the installer - this is pretty much a vanilla configuration as per installer defaults, with an unencrypted boot partition that asks me to unlock the disk.

In the case of my laptop being stolen, I don't have anything set up at the moment that would help me/the police recover it. For this reason, I want to configure a honey-trap that will allow the laptop to run Prey if a thief boots the laptop.

To do this, I want to move the standard GRUB, kernel and inital ramdisk onto a USB stick that I'll keep with me at all times. I'll install a copy of Tiny Core Linux (Or dare I say - Windows) on my laptop which will only boot when I don't plug in my USB stick.

To stop a potential thief from wiping the hard drive, I'm going to apply a BIOS password and disable booting from external devices. Obviously this wouldn't stop them removing the HDD and wiping it, but it's a step against a low-level thief.

If I do this, I won't be able to boot from my USB - so I'll need a way to chainload GRUB on my USB from GRUB on my hard drive.

Is this possible - if so, how can I do this/where can I find suitable documentation? Everywhere I've looked suggests using PLoP, LILO or some other software, when I'm sure this should be possible from GRUB alone.

Similarly, I could use UEFI Secure Boot to restrict booting onto only my honey trap and "true" kernels and initial ramdisks, but my laptop isn't UEFI-compatible :(

Similarly this could be an X/Y problem, so if you think I'm going about this the wrong way, feel free to suggest changes.

1
  • Since both physical and data security are paramount, and I assume you cannot physically remove the entire laptop to a secure locked location it might be easier to create a bootable usb stick and remove the hard drive to keep with you. This would provide access to the laptop to others and protect your data. Another option is boot from network with HD removed.
    – pfeiffep
    Mar 28, 2013 at 14:07

3 Answers 3

2

I think that you can try to mount the /boot partition on the usb key, but let the boot loader in the internal drive MBR. I am pretty sure that you can configure something like that with the Ubuntu installer: it is possible to mount nearly any point to any partition, and to choose in wich drive is written the MBR.

This way, the Bios would find the MBR on the internal drive, so you can disable external drive boot.

Here is the link to the complete doc about Grub 2: http://www.gnu.org/software/grub/manual/grub.html Maybe you should have a look at it and check if you can make a Grub script to check if your usb key is available. If it is, it would start your main system entry in Grub Menu as default. If not, it would start the entry with "Tiny Core Linux" and "Prey".

Also, you should go in #grub on the Freenode IRC.

6
  • It's possible to put /boot on a separate disk to the internal hard drive, but that's only half of what I want to do. I want to boot off the internal drive, then if usb is plugged in boot from that, otherwise boot from the hdd image with prey installed. As for the "reference to the usb key" - I presume I'd be able to use the UUID of the partition on the usb stick.
    – jackweirdy
    Mar 25, 2013 at 17:00
  • Could you please rewrite a bit you question in order to make it more clear? Because at this point, I am not sure anyone can really understand what you want to achieve...
    – ttoine
    Mar 25, 2013 at 17:30
  • Rephrased. I hope that's better :)
    – jackweirdy
    Mar 25, 2013 at 17:38
  • 1
    imho, if Grub can check that the usb key is here, you're done.
    – ttoine
    Mar 26, 2013 at 9:19
  • That's what I'm looking for :D
    – jackweirdy
    Mar 26, 2013 at 11:09
1

GRUB treats USB drives like other hard disks. I've had success booting kernels/installations on USB sticks from a grub installed to the MBR of an internal drive, by using something like:
root (hd1,0)
(To boot off the first partition of the second hard disk.)
That does assume consistent arrangement of drives. It is probably also possible to specify a partition by UUID - as ttoine said, check them man pages.

You can test at boot-up, by using c at the GRUB menu to access the GRUB command line (or edit an existing entry). Then (start up and) set up your config file with USB-boot as default, and presto.

(Just re-read that - yes, you can have GRUB load a new cfg from the usb stick, rather than a kernel.)

FWIW, I wouldn't expect much help from the police most places, even if you have the location of your machine. You might want to keep your /home/ on the USB; if not, at least back it up frequently.

1
  • maybe moving /home/ to the drive would be the most secure way of doing this. you are right.# May 12, 2016 at 9:34
0

Hide the GRUB boot menu with the hiddendelay option, make the default boot option your Prey installation, and password protect the menu. When you start it, you hit escape during the delay period, enter the password, and boot your regular installation. Somebody who's stolen it will just boot straight into Prey without even seeing that there are other boot options.

Now you don't have to worry about losing your USB drive.

If you really want to have the extra instructions on a USB drive, don't worry about chainloading. Instad just put the alternate grub.cfg on your thumbdrive and load it with the configfile directive. Grub2 has tab completion for paths so finding it should be relatively easy. Since you have to type in a password to boot anyway, just hitting c for command-line and pointing it at the second config file doesn't add significantly to the difficulty of booting.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .